How to change the Control-M/Enterprise Manager(EM) administrator user( default : emuser ) and database owner(DBO) password in CONTROL-M/Enterprise Manager?
 

There are two main administrator passwords in CONTROL-M/Enterprise Manager(EM):

- EM administrator password, defined in EM Authorizations and stored in generalauthorizations table, used by most client interfaces. Example: this is the administrator user used to log into the EM/GUI or Workload Automation GUI client.
- Database Owner(DBO) password, which is created and stored in the database server. Used by utilities that work directly on the database, such as util, ctl, cli etc.

Below is the procedures to change the DBO password on Control-M/EM 9.0.20 and higher :

This procedure describe how to change the Oracle, MSSQL, or PostgreSQL DBO password on UNIX and Windows. 
You must perform this procedure on all Control-M/EM installations (primary, secondary, and Control-M/EM Distributed) because they use the same database.

NOTE: If you are working in a High Availability environment, you must perform this procedure on the active Control-M/EM first and then on all other Control-M/EM servers. The first time you perform this procedure on the primary, you need the database administrator username and password.

To change the DBO password:

Shut down all Control-M/EM components on all Control-M/EM installations (primary, secondary, and Control-M/EM Distributed) and only the database is running.
Run one of the following on the primary host and then on all the other host:
UNIX: {BMC_Install_folder}/ctm_em/bin/em change_em_database_owner_password.sh
Windows: {BMC_Install_folder}\Control-M EM\Default\bin\change_em_database_owner_password.bat


Below is the procedures to change the DBO password on Control-M/EM 9.0.19 and lower



1. To change the EM Administrator password, executes the following steps:
a) From Workload Automation GUI (7.0.00 & 8.0.00), go to Tools menu -> Authorizations and choose the user to change the password.
b) From Control-M Configuration Manager(CCM) 9.0.00 and higher, go to Security menu -> Authorizations and choose the user to change the password.

- The password change will take effect when all active client login sessions are exited.
- When the last user with that username has logged out, the password is read again from the database. This is the product designed to avoid login users losing privileges in the middle of an active session.
- No restart of EM components is required.

2. To change EM DBO password, executes the following steps:
a) Stop all EM processes except EM database processes.

- From CCM, set the 'Desired State' for all EM components (such as Gateway, GAS, GUI Server, Forecast, BIM, Self Service) to 'Down' and wait till the 'Status' is confirmed the processes are down.
- (Unix) From root_menu -> Activation Menu, stop Control-M/EM Web Server( version 7.0.00 only), Control-M Configuration Server, Control-M/EM Configuration Agent and CORBA Naming Service
- (Windows) From services.msc, stop Control-M/EM Web Server(version 7.0.00 only), Control-M Configuration Server (version 7.0.00 and 8.0.00), Control-M/EM Configuration Agent and Naming Service(version 7.0.00 and 8.0.00) services.

- On Control-M/Enterprise Manager 9.0 and higher with High Availability, disable automatic failover by following the next steps:

I) From CCM -> right-click over the "Control-M EM"
II) Select Properties
III) Change the "Failover mode" from automatic to manual.

b) Login to EM database as the database administrator (DBA) account.

- Oracle: use the sqlplus command and log in as the SYSTEM account
- Sybase: use the command: isql -U sa -P <password>
- MSSQL: use the command: osql -U sa -P <password>
- PostgreSQL: 

UNIX ==> em psql -U postgres -P <password>
WIN   ==> em_sql -U postgres -P <password>

(NOTE - To change PostgreSQL DBA password, please refer to Knowledge Article 000028975)

c) Executes the following SQL statements to change the EM DBO password:

- Oracle:
  SQL> alter user <EM_DBO> identified by <new_pass>;

  For example:
   SQL> alter user emuser identified by newpassword;

- Sybase:
  1> sp_password "<sa_password>","<new_pass>",<EM_DBO>
  2> go

  For example:
   1> sp_password "password","newpassword",emuser
   2> go
 Note: you will need to use "" (quotes) around the passwords.

- MSSQL:
  1> ALTER LOGIN [EM_DBO] WITH PASSWORD=N'newpassword'
  2> go

  For example:
   1> ALTER LOGIN [emuser] WITH PASSWORD=N'newpassword'
   2> go
  Note: you will need to use "" (quotes) around the passwords.
  
This will set the password of the database account named "emuser" to "newpassword".

PostgreSQL:
  1>alter user <EM_DBO> with password '<new_pass>';

  For example:
   1> alter user emuser with password 'newpassword';
  Note: you will need to use '' (single quotes) around the password.

  where:
   <sa_password> is the password for the sa account
   <old_pass> is the old password for EM DBO
   <new_pass> is the new password value for EM DBO
   <EM_DBO> is the username for the EM DBO 

d) Exit the sql prompt (type "exit" or "\q")

e) Login with EM DBO to SQL prompt with the new EM DBO password to verify the change has been made.

f) Update the new EM DBO password into 'mcs.ini' on all EM installations that have a database client. This file existed on EM server(s) and EM client installation with Reporting Facility.

To update mcs.ini:

First, make a backup of the file:
  <windows_dir>\system32\mcs.ini    (Windows, version 6.1.02 or before)
  <EM_HOME>\ini\mcs.ini                  (Windows, version 6.1.03 or after)
  <$EM_HOME>/ini/mcs.ini                      (UNIX)

Run the utility cryptocli in the following manner:

On Windows, for EM versions up to 6.1.02:
      C:\> <ECS_HOME>\EcsServer\Cryptocli  <username> <newpassword> <windows_dir>\system32\mcs.ini

On Windows, for EM versions 6.1.03 and later:
      C:\> <EM_HOME>\bin\Cryptocli  <username> <newpassword> "<EM_HOME>\ini\mcs.ini"

 On UNIX for EM versions 6.1.03 and later:
      % ecs cryptocli  <username> <newpassword> $HOME/ini/mcs.ini

9.0.19 or above either Windows or Unix use the emcryptocli utility instead.

Verify that the files are changed.

g) Restart the Control-M/Enterprise Manager components

The following video demonstrates this solution: